2.1. Who this notice is for
This notice is for people who are cared for by a physiotherapist, massage therapist, doctor, sports coach or other specialist who uses Kusties (your "specialist"), and for parents and guardians (a child's legal representatives) who fill in forms on a child's behalf. It explains how your data is processed when you:
- open an exercise programme that your specialist sent you through a personal link;
- save a workout and your feedback on it;
- fill in a form before a visit;
- receive an e-mail or SMS about a visit or a form;
- see partner shop links next to the equipment in a programme (point 2.14);
- use the client cabinet (client cabinet terms: https://kusties.com/en/cabinet-terms).
Kusties is an online tool for specialists. Specialists' use of it is governed by the Terms of Service (https://kusties.com/en/terms) and the Privacy Policy (https://kusties.com/en/privacy).
2.2. Who is responsible for your data
- Your specialist is the controller. Your specialist decides what data about you to collect and how to use it: creates your record, writes notes and documents, prepares programmes, books visits and sends reminders and forms. The specialist's name is shown on the programme and form pages, in e-mails and in SMS.
- Kusties is the processor. SIA "Kusties.com" provides the app and processes this data on your specialist's behalf under a data processing agreement (GDPR Article 28). Kusties does not sell your data, does not build advertising profiles about you and does not pass your data to advertisers or partner shops; partner shop links next to the equipment are chosen only by the programme's equipment and your country (point 2.14). Your data is not used for analytics.
- When Kusties is the controller. Kusties processes in its own name:
- your IP address, briefly, to protect the service from abuse (point 2.4);
- your IP address, to determine your country for partner shop links (point 2.14); the address is not stored for this purpose;
- your client cabinet account, if you create one (point 13 of the client cabinet terms).
2.3. What data is processed
| When | What data | Who enters it |
|---|---|---|
| Your specialist cares for you | First and last name, e-mail address, phone number, contact language, date of birth (if given). The specialist's notes. Clinical documents (for example an examination, a visit note, a discharge summary), which may contain your personal code, address, family doctor, occupation, findings, diagnoses and plans. Safety alerts (for example about a pacemaker). Programmes and the specialist's private note on a programme. Visits: time, type, status, title and description. | the specialist |
| You open a programme link | The day the programme was last opened. Your browser sends your IP address and a description of your browser and device (user agent); they are received by the hosting provider and by Cloudflare, which plays the videos and shows the images. Kusties works out your country for partner shop links from the IP address without storing the address (point 2.14). | your browser |
| You save a workout | Time, duration, the exercises done, feedback on difficulty and length, and any notes you write. Your IP address is used briefly (up to one hour) to limit the number of requests; it is not stored with the workout. | you |
| You fill in a form | Your answers (they may be health data), the name you type to confirm, the confirmation tick and the time of submission. In the parent or guardian form, also the parent's or guardian's name, personal code, status, phone, e-mail and address, and a contact person. Unsent answers are kept in your browser until the link expires. When you submit the form, your specialist receives an e-mail that contains your first name. | you |
| You receive an e-mail or SMS | E-mail address or phone number, message content, language, purpose, time sent and status. Kusties keeps this in a message log; one-time links are not stored in the log. Appointment e-mails may contain the visit title and description as the specialist typed them, and a calendar file with your name may be attached to them. SMS contain no visit title, no name of yours and no health data. | the specialist, the system |
| You use the client cabinet | See point 13 of the client cabinet terms. | you |
2.4. Purposes and legal basis
- Your specialist processes the data to care for you: to prepare programmes, follow your progress, plan visits, remind you of them and receive your answers before a visit. The legal basis is the specialist's to determine. Usually it is the provision of health care (GDPR Article 9(2)(h)) or your explicit consent (GDPR Article 9(2)(a)).
- Kusties processes this data on your specialist's behalf (GDPR Article 28) to show programmes, store workouts and forms, send messages and keep the service running and secure, and to choose partner shop links by the programme's equipment and to leave them out for clients under 18 by their date of birth (point 2.14).
- Kusties in its own name uses your IP address briefly to limit excessive requests and protect the service from abuse. The basis is Kusties' legitimate interests (GDPR Article 6(1)(f)).
- Kusties in its own name works out your country from your IP address to show partner shop links for your country (point 2.14). The basis is Kusties' legitimate interests (GDPR Article 6(1)(f)): offering a shop available in your country and funding the service through commissions. You can object by choosing a country in the "Shop country" list.
2.5. Who receives the data
- Your specialist. Each specialist has their own record about you. Other specialists do not see your data, and Kusties does not merge records.
- Kusties administrators. In the app, administrators can open specialists' client records (contact details), programmes, the workouts and feedback you saved, visits and the log of messages sent to patients, including message content. The specialist's notes, clinical documents, safety alerts and the programme's private note are visible in the app only to the specialist who created them. Persons with access to Kusties' infrastructure (the database, backups and the encryption key) are technically able to access all data.
- Sub-processors that Kusties uses:
| Recipient | Purpose | What it receives | Where |
|---|---|---|---|
| DigitalOcean | hosting the app and the database | all app data | Frankfurt, Germany (EU); company registered in the USA |
| Redis Cloud | short-lived security data | IP address in request counters and sign-in data; no health data | Frankfurt, Germany (EU) |
| Brevo | sending SMS; sending e-mail | e-mail address, phone number, message content | EU (France) |
| Cloudflare | showing videos and images | IP address and browser and device description when a page loads videos and images | global network; company registered in the USA |
- Message carriers: your e-mail provider and your mobile operator.
- Public authorities, where the law requires it.
- Partner shops (point 2.14) receive no data from Kusties. If you open a partner link, the shop receives data directly from your browser and processes it as a separate controller under its own privacy policy. DB-IP, which provides the country database, receives none of your data.
2.6. Transfers outside the EEA
The database that holds your data is in the EU (Frankfurt). DigitalOcean and Cloudflare are US companies, and Cloudflare runs a global network. Where data is transferred outside the European Economic Area, this is based on a European Commission adequacy decision (GDPR Article 45) or on standard data protection clauses (GDPR Article 46(2)(c)).
2.7. How long data is kept
| Data | Retention |
|---|---|
| The specialist's record, notes, clinical documents, programmes, workouts, visits | As long as the specialist keeps them under the specialist's own professional and legal obligations. At present, a record deleted in the app is hidden rather than permanently deleted, and finalised clinical documents cannot be deleted. |
| Safety alerts | Until the specialist deletes them (they are then permanently deleted). |
| Form link | Valid for 14 days. |
| Unsent answers in your browser | Until you submit or until the link expires. |
| Message log (recipient and content) | At present with no end date; after the specialist's agreement ends, it is deleted under the data processing agreement. |
| IP address in request counters | From one minute to 24 hours (depending on the limit). |
| IP address used to determine your country for partner shop links | Not stored: used only in the server's memory while the page is prepared. |
| The country you chose for partner shop links | In your browser, until you clear your browser data; in the Android app, until the app is closed. |
| Number of times partner shop links were opened | Per link and day, with no data about you; kept while the link exists. |
| The hosting provider's technical logs | Under the hosting provider's retention policy. The app's own logs contain no IP addresses. |
| Client cabinet account | See point 13 of the client cabinet terms. |
2.8. How data is protected
- The database is in the EU.
- The specialist's notes, clinical documents, safety alerts and the programme's private note are encrypted with a separate encryption key (AES-256-GCM). Other data, such as contact details, visits, workout feedback and the message log, is not separately encrypted.
- A programme link contains two random identifiers. A form link is single-use and valid for 14 days, and the server stores only its hash.
- The app's logs do not record IP addresses, e-mail addresses, phone numbers, links or message content.
- Access is limited by role. Two-step sign-in is mandatory for Kusties administrators.
What you can do:
- don't forward a programme or form link to others;
- on a shared computer, don't leave a form unsubmitted;
- if a link has reached someone else, contact your specialist: the specialist can finish the programme (new workouts can then no longer be saved, but the programme and its videos can still be seen through the link), ask Kusties to disable the programme so that it no longer opens through the link, and send a new form link.
2.9. Cookies and browser storage
Patient pages use no analytics or advertising cookies, and no analytics tools are loaded on these pages. The partner shop link counter (point 2.14) is not an analytics tool: Kusties counts, per partner link and day, how often it was opened; no cookie, IP address or identifier is read or stored. When you open a partner shop's page, the shop may set its own cookies.
| Name | Type | Purpose | How long |
|---|---|---|---|
locale | cookie | interface language | 1 year |
theme, workout-theme, videos-paused | browser storage | the look you chose and video playback | until you clear your browser data |
shop-country | browser storage | the country you chose for partner shop links; written only when you choose a country | until you clear your browser data |
kusties-form-draft:<…> | browser storage | a form's unsent answers, so they are not lost if the page reloads | until you submit or the link expires |
| Cloudflare video player | third-party embedded page | playing videos | under Cloudflare's terms |
The Android app stores only the player's colour theme on the device; a country chosen for partner shop links is remembered only until the app is closed.
2.10. Minors
- A specialist may also care for children. A child's forms are usually filled in by a parent or guardian, and the parent or guardian consent form also collects the parent's or guardian's own data (point 2.3).
- A child's data rights are usually exercised by the parent or guardian.
- The client cabinet is not available to children: it can be used only from the age of 18 (point 4 of the client cabinet terms).
- Partner shop links are not shown if the date of birth in the specialist's record shows that the client is under 18 (point 2.14).
2.11. Automated decisions
No decisions are made about you based solely on automated processing that have legal or similarly significant effects on you (GDPR Article 22). Only one step may count as profiling (GDPR Article 4(4)): for partner shop links, Kusties automatically works out your country from your IP address (point 2.14). The country is not stored or combined with other data, and it only decides which country's shop links you see. These technical steps also happen automatically:
- a programme ends automatically on the day after the end date set by the specialist;
- too many requests from one IP address are limited for a short time;
- a cabinet invitation is withdrawn after five wrong birth-year entries;
- partner shop links are not shown to clients whose date of birth in the specialist's record shows that they are under 18.
2.12. Your rights
Under the GDPR you have the right to:
- access your data and get a copy (Article 15);
- have inaccurate data corrected (Article 16);
- ask for your data to be erased (Article 17) where the controller has no duty to keep it;
- restrict processing (Article 18);
- receive the data you provided in a machine-readable format and transfer it to another controller (Article 20);
- object to processing based on legitimate interests (Article 21); you can object to the country being determined for partner shop links by choosing a country in the "Shop country" list (point 2.14);
- withdraw consent at any time where processing is based on consent (Article 7(3)). Withdrawal does not affect the lawfulness of processing before it.
Patients also have the rights set out in the Pacientu tiesību likums (Patients' Rights Law).
How to use your rights:
- Contact your specialist. The specialist is the controller and answers your request. The controller must answer within one month; in certain cases this period can be extended (GDPR Article 12(3)).
- If you write to Kusties at info@kusties.com, we will forward your request to your specialist without undue delay and help them answer it (GDPR Article 28(3)(e)). To protect your data, we may ask you to confirm your identity.
- Patients cannot currently download their own data themselves; the specialist prepares the copy.
- The app has no permanent deletion function at present; on the specialist's instruction, Kusties deletes the data manually.
Complaints. If you believe your data is processed unlawfully, you can complain to the Datu valsts inspekcija (Data State Inspectorate, www.dvi.gov.lv) or to the supervisory authority of the EU member state where you live or work (GDPR Article 77).
2.13. Changes and contacts
- We may update this notice, for example when the app's features or the law change. Each version has a number and a date. The current version is always on this page.
- For questions about your care and the data your specialist keeps, contact your specialist.
- Kusties: SIA "Kusties.com", registration No. 50203259371, legal address: Ābolu iela 14C, Mārupe, Mārupes nov., LV-2167, e-mail: info@kusties.com.
2.14. Partner shop links
- What they are. Next to the equipment in a programme (for example a mat or a resistance band) you may see links to partner shops where that equipment can be bought: on the programme link, in the client cabinet and in the Android app. They are advertising: they are marked "Ad", and the partner is named next to them (for example Megango (SIA ORCCAN)). If you buy an item after opening a link, Kusties earns a commission from the partner. Kusties chooses the links; your specialist does not choose them and earns nothing from them. The links are not a treatment recommendation, and any equivalent equipment will do.
- How the links are chosen. Only by the programme's equipment and your country. Kusties passes none of your data to partners and builds no advertising profile about you.
- Your country. To offer a shop in your country, Kusties works out your country from your IP address. The address is shortened (its last part is dropped) and looked up in a country database in the memory of Kusties' server; neither the address nor the country is stored or written to logs for this purpose. If the country cannot be determined, Latvia is used. The basis is Kusties' legitimate interests (GDPR Article 6(1)(f)): offering a shop available in your country and funding the service through commissions. The "IP to Country Lite" country database is provided by DB-IP (https://db-ip.com) under the Creative Commons Attribution 4.0 International licence (https://creativecommons.org/licenses/by/4.0/), which is why, when the country was determined from your IP address, the credit "IP Geolocation by DB-IP" is shown next to the links. DB-IP receives none of your data.
- How to object. You can object to your country being determined at any time (GDPR Article 21): choose a country in the "Shop country" list, and your country is then no longer determined from your IP address. On the web the choice is kept in this browser (
shop-country, point 2.9); in the Android app until the app is closed. If you do not want to see the links at all, ask your specialist: they can switch them off for all their patients in their profile, and your country is then not determined for their patients. You can also write to Kusties at info@kusties.com. - Minors. If the date of birth in your specialist's record shows that you are under 18, you are not shown the links. If no date of birth is recorded, or the programme is opened through a public link that is not addressed to a particular client, the age is not known, and the links may be shown.
- What the shop learns. A link first opens a Kusties address, which forwards your browser straight to the shop's product page with the code the partner gave Kusties. Nothing about you, your programme or your specialist is added, and the shop is not told which page the link was opened from; it learns only that the page was opened through a Kusties partner link. From then on the shop processes your data (for example your IP address and its own cookies) as a separate controller under its own privacy policy, and a purchase is a transaction between you and the shop.
- Counting. Kusties counts, per partner link and day, how often it was opened; no cookie, IP address or identifier is read or stored.